C ++在后台监视正在运行的进程? [英] C++ monitor running processes in the background?

问题描述

我一直在尝试用C ++编写一个程序，该程序将在后台监视正在运行的进程，并在检测到某个程序正在运行时终止该程序.我已经编写了一个程序来执行此操作，但是我想到的唯一方法是使用无限的WHILE循环来不断检查程序.您可以想象，这会不断使用CPU功能和资源来不断循环.在任务管理器中，您可以看到大多数正在运行的进程始终使用0％的CPU.我的问题是:如何编写或修改该程序以在后台运行，利用0％的CPU，直到它检测到应该终止的进程? 我的整个程序在下面.在此示例中，我使用了WinMain中的"Notepad.exe"作为程序应终止的过程.

I've been trying to write a program in C++ that will monitor running processes in the background and terminate a certain one if it's detected to be running. I have written a program that will do so, however the only way I can think of to do this is to use an infinite WHILE loop that keeps checking for the program. This, as you can imagine, constantly uses CPU power and resources to be constantly looping. In task manager, you can see that most processes that are running are always using 0% of the CPU. My question is: How can I write or modify this program to run in the background, utilizing 0% of the CPU until it detects the process it's supposed to terminate? My entire program is below. In this example, I have used "Notepad.exe" in WinMain as the process the program should be terminating.

#include <Windows.h>
#include <iostream>
#include <tlhelp32.h>
#include <string>
#define TA_FAILED 0
#define TA_SUCCESS_CLEAN 1
#define TA_SUCCESS_KILL 2

DWORD WINAPI TerminateApp(DWORD dwPID, DWORD dwTimeout);
DWORD WINAPI Terminate16App(DWORD dwPID, DWORD dwThread, WORD w16Task, DWORD dwTimeout);

typedef struct {
   DWORD dwID;
   DWORD dwThread;
} TERMINFO;

BOOL CALLBACK TerminateAppEnum( HWND hwnd, LPARAM lParam ) ;

DWORD WINAPI TerminateApp( DWORD dwPID, DWORD dwTimeout ) {
  HANDLE   hProc ;
  DWORD   dwRet ;

  // If we can't open the process with PROCESS_TERMINATE rights,
  // then we give up immediately.
  hProc = OpenProcess(SYNCHRONIZE|PROCESS_TERMINATE, FALSE,
     dwPID);

  if(hProc == NULL) {
     return TA_FAILED ;
  }

  // TerminateAppEnum() posts WM_CLOSE to all windows whose PID
  // matches your process's.
  EnumWindows((WNDENUMPROC)TerminateAppEnum, (LPARAM) dwPID) ;

  // Wait on the handle. If it signals, great. If it times out,
  // then you kill it.
  if(WaitForSingleObject(hProc, dwTimeout)!=WAIT_OBJECT_0)
     dwRet=(TerminateProcess(hProc,0)?TA_SUCCESS_KILL:TA_FAILED);
  else
     dwRet = TA_SUCCESS_CLEAN ;

  CloseHandle(hProc) ;

  return dwRet ;
}

BOOL CALLBACK TerminateAppEnum( HWND hwnd, LPARAM lParam ) {
  DWORD dwID ;

  GetWindowThreadProcessId(hwnd, &dwID) ;

  if(dwID == (DWORD)lParam) {
     PostMessage(hwnd, WM_CLOSE, 0, 0) ;
  }
  return TRUE ;
}

DWORD FindProcessId(const std::string& processName);

int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR szCmdLine, int iCmdShow) {

    std::string process1 = "Notepad.exe";
    while (1) {
    TerminateApp(FindProcessId(process1),0);
    }
return 0;
}

DWORD FindProcessId(const std::string& processName) {

   PROCESSENTRY32 processInfo;
   processInfo.dwSize = sizeof(processInfo);

   HANDLE processesSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
   if (processesSnapshot == INVALID_HANDLE_VALUE) {
      return 0;
   }
   Process32First(processesSnapshot, &processInfo);
   if (!processName.compare(processInfo.szExeFile)) {
      CloseHandle(processesSnapshot);
      return processInfo.th32ProcessID;
   }

   while (Process32Next(processesSnapshot, &processInfo)) {

      if (!processName.compare(processInfo.szExeFile)) {
         CloseHandle(processesSnapshot);
         return processInfo.th32ProcessID;
      }
   }
   CloseHandle(processesSnapshot);
   return 0;
}

推荐答案

您可以使用 WMI和事件通知，以查找何时创建和销毁进程. __InstanceCreationEvent是您所需要的.

You can use WMI and event notification to find when processes are created and destroyed. __InstanceCreationEvent is what you need to look for.

创建资源:__InstanceCreationEvent

假设您有兴趣在某些计算机上运行记事本时收到通知.运行记事本时，将创建一个相应的进程.进程可以使用WMI进行管理，并由Win32_Process类表示.当记事本开始运行时，可以通过WMI使用Win32_Process类的相应实例.如果您已对此事件感兴趣(通过发出适当的事件通知查询)，则此实例的可用性将导致创建__InstanceCreationEvent类的实例.

Suppose you are interested in receiving a notification if Notepad is run on a certain computer. When Notepad runs, a corresponding process is created. Processes can be managed by using WMI and are represented by the Win32_Process class. When Notepad starts running, a corresponding instance of the Win32_Process class becomes available through WMI. If you have registered your interest in this event (by issuing the appropriate event notification query), the availability of this instance results in the creation of an instance of the __InstanceCreationEvent class.

这篇关于C ++在后台监视正在运行的进程?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！