监控系统进程启动 [英] Monitor process start in the system

问题描述

有没有办法启动系统才开始监控流程？

Is there a way to monitor processes starting in the system before they start?

例：
在象ZoneAlarm或防病毒程序的程序，当你运行一个程序会询问您是否允许运行此程序或不运行前...

Example:
On programs like ZoneAlarm or Antivirus programs, when you run a program it asks you if you allow running this program or not before it runs...

推荐答案

您应该检查 easyhook-持续，少走弯路的项目，该项目是微软走弯路项目的.NET端口。它可以让你上钩非托管API（如CreateProcess的）。查看code例子一个简单的FileMon样的程序这里

You should check out the easyhook-continuing-detours project, which is a .NET port of the Microsoft Detours project. It will allow you to hook unmanaged APIs (such as CreateProcess). Check out code examples for a simple FileMon-like program here.

这篇关于监控系统进程启动的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！