使用WMI監視進程的創建活動

根據其他職位（How to detect win32 process creation/termination in c++）

我按照它來註冊我的回調函數，但它不工作。

什麼都沒有發生，當我運行這個程序，並打開IEXPLORE

請幫幫我，謝謝

#define _WIN32_DCOM 
#include <iostream> 
using namespace std; 
#include <comdef.h> 
#include <Wbemidl.h> 
#include <atlcomcli.h> 

#pragma comment(lib, "wbemuuid.lib") 
#include "CreationEvent.h" 

class EventSink : public IWbemObjectSink { 
    friend void CreationEvent::registerCreationCallback(TNotificationFunc callback); 

    CComPtr<IWbemServices> pSvc; 
    CComPtr<IWbemObjectSink> pStubSink; 
    LONG m_IRef; 
    CreationEvent::TNotificationFunc m_callback; 

public: 
    EventSink(CreationEvent::TNotificationFunc callback) :m_IRef(0), m_callback(callback){} 
    ~EventSink(){ 
    } 

    virtual ULONG STDMETHODCALLTYPE AddRef() { 
     return InterlockedIncrement(&m_IRef); 
    } 

    virtual ULONG STDMETHODCALLTYPE Release() { 
     LONG IRef = InterlockedDecrement(&m_IRef); 
     if (IRef == 0) 
      delete this; 
     return IRef; 
    } 

    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppv) { 
     if (riid == IID_IUnknown || riid == IID_IWbemObjectSink) { 
      *ppv = (IWbemObjectSink*) this; 
      AddRef(); 
      return WBEM_S_NO_ERROR; 
     } 
     else return E_NOINTERFACE; 
    } 

    virtual HRESULT STDMETHODCALLTYPE Indicate(
     LONG lObjectCount, 
     IWbemClassObject __RPC_FAR *__RPC_FAR *apObjArray 
    ){ 
     m_callback(); 
     /* Unregister event sink */ 
     pSvc->CancelAsyncCall(pStubSink); 
     return WBEM_S_NO_ERROR; 
    } 
    virtual HRESULT STDMETHODCALLTYPE SetStatus(LONG IFlags, HRESULT hResult, BSTR strParam, IWbemClassObject __RPC_FAR *pObjParam) { 
     return WBEM_S_NO_ERROR; 
    } 
}; 

void CreationEvent::registerCreationCallback(TNotificationFunc callback) { 
    CComPtr<IWbemLocator> pLoc; 
    CoInitialize(NULL); 
    HRESULT hres = CoCreateInstance(CLSID_WbemLocator, 0, CLSCTX_INPROC_SERVER, IID_IWbemLocator, (LPVOID*)&pLoc); 

    if (FAILED(hres)) { 
     cout << "Failed to create IWbemLocator object." 
      << " Err code = 0x" 
      << hex << hres << endl; 
     throw std::exception("CreationEvent initialization failed"); 
    } 
    CComPtr<EventSink> pSink(new EventSink(callback)); 

    hres = pLoc->ConnectServer(_bstr_t(L"ROOT\\CIMV2"), NULL, NULL, 0, NULL, 0, 0, &pSink->pSvc); 
    if (FAILED(hres)) { 
     cout << "Could not connect. Error code = 0x" << hex << hres << endl; 
     throw std::exception("CreationEvent initialization failed"); 
    } 
    hres = CoSetProxyBlanket(pSink->pSvc, RPC_C_AUTHN_WINNT, RPC_C_AUTHZ_NONE, NULL, RPC_C_AUTHN_LEVEL_CALL, RPC_C_IMP_LEVEL_IMPERSONATE, NULL, EOAC_NONE); 
    if (FAILED(hres)) { 
     cout << "Coult not set proxy blanket, Error code =0x" << hex << hres << endl; 
     throw std::exception("CreationEvent initialization failed"); 
    } 

    CComPtr<IUnsecuredApartment> pUnsecApp; 
    hres = CoCreateInstance(CLSID_UnsecuredApartment, NULL, CLSCTX_LOCAL_SERVER, IID_IUnsecuredApartment, (void**)&pUnsecApp); 
    CComPtr<IUnknown> pStubUnk; 
    pUnsecApp->CreateObjectStub(pSink, &pStubUnk); 
    pStubUnk->QueryInterface(IID_IWbemObjectSink, (void**)&pSink->pStubSink); 


    char buffer[512]; 
    sprintf_s(buffer, "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'iexplore.exe'"); 

    hres = pSink->pSvc->ExecNotificationQueryAsync(_bstr_t("WQL"), _bstr_t(buffer), WBEM_FLAG_SEND_STATUS, NULL, pSink->pStubSink); 

    if (FAILED(hres)) { 
     cout << "ExecNotificationQueryAsync failed with = 0x" << hex << hres << endl; 
     throw std::exception("CreationEvent initialization failed"); 
    } 
} 

void k() { cout << "KKKKK " << endl; } 

int main() { 
    CreationEvent::registerCreationCallback(k); 
    cin.get(); 
}

CreationEvent.h

#pragma once 
#ifndef _CreationEvent_h__ 
#define _CreationEvent_h__ 

#include <boost/function.hpp> 

namespace CreationEvent { 
    typedef boost::function<void(void)> TNotificationFunc; 
    void registerCreationCallback(TNotificationFunc callback); 
} 

#endif

來源

2017-04-07 Lion Kuo

建議 - 嘗試省略'AND TargetInstance.Name =「iexplore.exe''條款，以確保您的回調當任何*進程啓動時調用。如果有效，請嘗試排除其他過濾條件。 –

我曾嘗試過，但它不起作用 –

此MSDN文章看起來像幾乎完全一樣你想要做的（沒有進程名稱過濾器）。我會深入探討所有步驟，看看你是否能夠運行。另外，如果以管理員身份運行，我會對知道它是否以不同的方式工作感興趣。 [示例：通過WMI接收事件通知]（https://msdn.microsoft.com/en-us/library/aa390425（v = vs.85）.aspx） –

回去，並審閱本文Example: Receiving Event Notifications Through WMI，並發現了一個顯然重要的區別。

在方法CreationEvent::registerCreationCallback(...)，替換：

CoInitialize(NULL);

有：

CoInitializeEx(0, COINIT_MULTITHREADED);

來源

2017-04-07 18:15:13

謝謝你的幫助，它的工作原理！我沒有注意到-Ex之間的區別。 –

很高興聽到，很高興幫助！ –

使用WMI監視進程的創建活動

回答

相關問題