How can I detect the start of an application from
another app? (Like some software metering program does.)
?rd?gh L?szl?
mailto:xxxxx@digital.co.hu mailto:xxxxx
------------------------------------------------------------------
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com</mailto:xxxxx>
Hi ?rd?gh
Have a process which monitors the process list, and detects when your app
appears on it.
Download the kill process code which I have on my website, for example of
how to walk the process list on win 95 / nt
http://www.rowanclose.com/utils/killps.html
http:
Have fun and enjoyable weekend
Take care
Robert Fernando
Anite Telecoms Ltd
110 Fleet Road
Fleet
Hampshire GU51 4BL
United Kingdom
Tel: +44 (0) 1252 775200
Fax: +44 (0) 1252 775 321
Email: xxxxx@anitetelecoms.com
Anite Telecoms Limited Registered in England No. 1721900 Registered
Office: 100 Longwater Avenue, GreenPark, Reading, Berkshire RG2 6GP,
United Kingdom
-----Original Message-----
From: ?rd?gh L?szl? [mailto:xxxxx@digital.co.hu]
Sent: 30 November 2001 13:18
To: NT Developers Interest List
Subject: [ntdev] application start detection
How can I detect the start of an application from
another app? (Like some software metering program does.)
-----------------------------------------------------------------
?rd?gh L?szl?
mailto:xxxxx mailto:xxxxx@digital.co.hu
------------------------------------------------------------------
—
You are currently subscribed to ntdev as: xxxxx@anitetelecoms.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com</mailto:xxxxx></http:>
Thx for your answer Robert!
This is a very straightforward approach.
Is it possible to get some form of notification before
the OS launch the process? What if I want to prevent
the start of application? If I use the process list monitoring
method and I decide to not let to run the process I have to
kill it. I think this could be dangerous to kill a starting
(for example) database application.
-----Original Message-----
From: Fernando, Robert [mailto:xxxxx@anitetelecoms.com]
Sent: Friday, November 30, 2001 3:43 PM
To: NT Developers Interest List
Subject: [ntdev] RE: application start detectionHi ?rd?gh
Have a process which monitors the process list, and detects
when your app appears on it.Download the kill process code which I have on my website,
for example of how to walk the process list on win 95 / nt
http://www.rowanclose.com/utils/killps.html
http:
Have fun and enjoyable weekend
Take care
Robert Fernando
Anite Telecoms Ltd
110 Fleet Road
Fleet
Hampshire GU51 4BL
United Kingdom
Tel: +44 (0) 1252 775200
Fax: +44 (0) 1252 775 321
Email: xxxxx@anitetelecoms.com
Anite Telecoms Limited Registered in England No. 1721900 Registered
Office: 100 Longwater Avenue, GreenPark, Reading, Berkshire RG2 6GP,
United Kingdom
-----Original Message-----
From: ?rd?gh L?szl? [mailto:xxxxx@digital.co.hu]
Sent: 30 November 2001 13:18
To: NT Developers Interest List
Subject: [ntdev] application start detection
How can I detect the start of an application from
another app? (Like some software metering program does.)
-----------------------------------------------------------------
?rd?gh L?szl?
mailto:xxxxx mailto:xxxxx@digital.co.hu
------------------------------------------------------------------
—
You are currently subscribed to ntdev as:
xxxxx@anitetelecoms.com To unsubscribe send a blank email to
leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: xxxxx@digital.co.hu To
unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com</mailto:xxxxx></http:>
MessageHook on ZwCreateProcess from your driver, and queue the calls, then you can query the driver from a user-mode application.
Adel.
----- Original Message -----
From: ?rd?gh L?szl?
To: NT Developers Interest List
Sent: Friday, November 30, 2001 8:18 AM
Subject: [ntdev] application start detection
How can I detect the start of an application from
another app? (Like some software metering program does.)
You are currently subscribed to ntdev as: xxxxx@cifnet.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You can also register a callback to notify you when a new process has
started; threads too. Check the DDK for more information
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Adel Abushaev
Sent: Friday, November 30, 2001 10:18 AM
To: NT Developers Interest List
Subject: [ntdev] Re: application start detection
Hook on ZwCreateProcess from your driver, and queue the calls, then you
can query the driver from a user-mode application.
Adel.
----- Original Message -----
From: ?rd?gh mailto:xxxxx L?szl?
To: NT Developers Interest List mailto:xxxxx
Sent: Friday, November 30, 2001 8:18 AM
Subject: [ntdev] application start detection
How can I detect the start of an application from
another app? (Like some software metering program does.)
-----------------------------------------------------------------
?rd?gh L?szl?
mailto:xxxxx mailto:xxxxx@digital.co.hu
------------------------------------------------------------------
—
You are currently subscribed to ntdev as: xxxxx@cifnet.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: xxxxx@storagecraft.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com</mailto:xxxxx></mailto:xxxxx></mailto:xxxxx>
> ----------
From: xxxxx@digital.co.hu[SMTP:xxxxx@digital.co.hu]
Reply To: xxxxx@lists.osr.com
Sent: Friday, November 30, 2001 4:13 PM
To: xxxxx@lists.osr.com
Subject: [ntdev] RE: application start detectionIs it possible to get some form of notification before
the OS launch the process?
See PsSetCreateProcessNotifyRoutine() docs. Note it only monitors process
creation, it is impossible to prevent start.
What if I want to prevent
the start of application?
Hook ZwCreateProcess, maybe.
Best regards,
Michal Vodicka
STMicroelectronics Design and Application s.r.o.
[michal.vodicka@st.com, http:://www.st.com]
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
PsSetCreateProcessNotifyRoutine
Alexey Logachyov
xxxxx@vba.com.by
VirusBlokAda Ltd.
http://www.vba.com.by
----- Original Message -----
From: “?rd?gh L?szl?”
To: “NT Developers Interest List”
Sent: Friday, November 30, 2001 5:13 PM
Subject: [ntdev] RE: application start detection
> Thx for your answer Robert!
>
> This is a very straightforward approach.
> Is it possible to get some form of notification before
> the OS launch the process? What if I want to prevent
> the start of application? If I use the process list monitoring
> method and I decide to not let to run the process I have to
> kill it. I think this could be dangerous to kill a starting
> (for example) database application.
>
> -----------------------------------------------------------------
> ?rd?gh L?szl?
> mailto:xxxxx@digital.co.hu
> ------------------------------------------------------------------
>
>
>
> > -----Original Message-----
> > From: Fernando, Robert [mailto:xxxxx@anitetelecoms.com]
> > Sent: Friday, November 30, 2001 3:43 PM
> > To: NT Developers Interest List
> > Subject: [ntdev] RE: application start detection
> >
> >
> > Hi ?rd?gh
> > Have a process which monitors the process list, and detects
> > when your app appears on it.
> >
> > Download the kill process code which I have on my website,
> > for example of how to walk the process list on win 95 / nt
> >
> http://www.rowanclose.com/utils/killps.html
> http:
>
> Have fun and enjoyable weekend
>
> Take care
>
>
> Robert Fernando
> Anite Telecoms Ltd
> 110 Fleet Road
> Fleet
> Hampshire GU51 4BL
> United Kingdom
> Tel: +44 (0) 1252 775200
> Fax: +44 (0) 1252 775 321
> Email: xxxxx@anitetelecoms.com
>
> Anite Telecoms Limited Registered in England No. 1721900 Registered
> Office: 100 Longwater Avenue, GreenPark, Reading, Berkshire RG2 6GP,
> United Kingdom
>
>
>
> -----Original Message-----
> From: ?rd?gh L?szl? [mailto:xxxxx@digital.co.hu]
> Sent: 30 November 2001 13:18
> To: NT Developers Interest List
> Subject: [ntdev] application start detection
>
>
> How can I detect the start of an application from
> another app? (Like some software metering program does.)
>
> -----------------------------------------------------------------
> ?rd?gh L?szl?
> mailto:xxxxx mailto:xxxxx@digital.co.hu
> ------------------------------------------------------------------
>
>
> —
> You are currently subscribed to ntdev as:
> xxxxx@anitetelecoms.com To unsubscribe send a blank email to
> leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@digital.co.hu To
> unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
> —
> You are currently subscribed to ntdev as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com</mailto:xxxxx></http:>