🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: borland.public.cppbuilder.nativeapi
Article #15090

Re: program start detection question

#15090
From: Remy Lebeau (TeamB)
Date: Sun, 20 Jul 2003 05:46
44 lines
3154 bytes
"micheal davis" <micheal_davis@hotmail.com> wrote in message
news:3f19cb88@newsgroups.borland.com...

> my main task is that when my application is running on
> the client machine and the client is trying to load another
> application for example (notepad.exe) I will be notified

There is no way to be notified when an actual process itself is started, nor
do all processes create windows which a hook would detect being created.
With that said...

> so I am really not expert with hooks and the SetWindowsHookEx...
> but do u think that this function will solve my problem...

Assuming Notepad creates a window (which it does), you could use
SetWindowsHookEx() to set up a WH_SHELL hook that detects
HSHELL_WINDOWCREATED notifications.  The hook's callback function will
include the HWND of the window that is being created.  From that, you can
use GetWindowThreadProcessId() to determine the process ID for the window
and then resolve that ID to the application name by enumerating the
currently running application processes until you find a matching ID.

Keep in mind, though, that such a hook would be triggered whenever any
window is being created by any application, including every window created
by applications that create multiple windows at a time.

> and if not do you have any other suggestions, other
> than this function and making a timed thread to
> search the windows running programs list...

It may be possible by writing your own custom VXD, but I have no experience
with those myself so I don't know what all they can do (although I do know
that they can do some pretty powerful things at a level much lower than the
Win32 API provides access to).

Another possibility would be to write a DLL that installs any system wide
hook (also via SetWindowsHookEx()).  Whenever a new process is created, your
DLL will automatically be injected into its address space, so you can use
the DLL_ATTACH_PROCESS parameter of your DLL's DllEntryPoint() function to
detect new processes starting.


Gambit
Technical Details
Message-ID: <3f1a2b82$1@newsgroups.borland.com>
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-03!sn-xit-01!sn-xit-09!supernews.com!newshosting.com!news-xfer1.atl.newshosting.com!newsfeed.wirehub.nl!news.kweb.on.ca!KWeb!newsgroups.borland.com!not-for-mail
References: <3f18866a@newsgroups.borland.com> <3f188794$1@newsgroups.borland.com> <3f188ab7@newsgroups.borland.com> <3f188f1a$1@newsgroups.borland.com> <3f19cb88@newsgroups.borland.com>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10cc67,9f5ad18ed5a65075
X-Google-Attributes: gid10cc67,public
X-Google-ArrivalTime: 2003-07-19 22:52:03 PST
From: "Remy Lebeau \(TeamB\)" <gambit47@yahoo.com>
Newsgroups: borland.public.cppbuilder.nativeapi
References: <3f18866a@newsgroups.borland.com> <3f188794$1@newsgroups.borland.com> <3f188ab7@newsgroups.borland.com> <3f188f1a$1@newsgroups.borland.com> <3f19cb88@newsgroups.borland.com>
Subject: Re: program start detection question
Date: Sat, 19 Jul 2003 22:46:44 -0700
Lines: 46
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
NNTP-Posting-Host: 207.175.226.26
Message-ID: <3f1a2b82$1@newsgroups.borland.com>
X-Trace: newsgroups.borland.com 1058679682 207.175.226.26 (19 Jul 2003 22:41:22 -0700)
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-03!sn-xit-01!sn-xit-09!supernews.com!newshosting.com!news-xfer1.atl.newshosting.com!newsfeed.wirehub.nl!news.kweb.on.ca!KWeb!newsgroups.borland.com!not-for-mail