WMI监视进程启动

来源：互联网发布：怎么发网络短信编辑：程序博客网时间：2024/05/19 19:13
// WMIProcessCreateMonitor.cpp : 定义控制台应用程序的入口点。//#include "stdafx.h"#include <iostream>#include <windows.h>#include <Shlwapi.h>#include <comdef.h>#include <wbemidl.h>using namespace std;#pragma comment(lib, "wbemuuid.lib")#pragma comment(lib, "Shlwapi.lib")int _tmain(int argc, _TCHAR* argv[]){        HRESULT hRet = S_OK;        // 初始化COM组件        hRet = CoInitializeEx(NULL, COINIT_MULTITHREADED);        if (FAILED(hRet))        {                cout<<"初始化COM库组件失败。错误码："<<hRet<<endl;                return hRet;        }        IWbemLocator *pIWbemLocator = NULL;        hRet = CoCreateInstance(CLSID_WbemLocator, NULL, CLSCTX_INPROC_SERVER, IID_IWbemLocator, (LPVOID*)&pIWbemLocator);        if (FAILED(hRet))        {                cout<<"创建IWbemLocator对象失败！错误码："<<hRet<<endl;                CoUninitialize();                return hRet;        }        IWbemServices *pIWbemServices = NULL;        bstr_t strNetwoekResource("ROOT\\CIMV2");        hRet = pIWbemLocator->ConnectServer(strNetwoekResource, NULL, NULL, NULL, 0, NULL, NULL, &pIWbemServices);        if (FAILED(hRet))        {                cout<<""<<hRet<<endl;                pIWbemLocator->Release();                CoUninitialize();                return hRet;        }        hRet = CoSetProxyBlanket(pIWbemServices, RPC_C_AUTHN_WINNT, RPC_C_AUTHZ_NONE, NULL, RPC_C_AUTHN_LEVEL_CALL, RPC_C_IMP_LEVEL_IMPERSONATE, NULL, EOAC_NONE);        if (FAILED(hRet))        {                cout<<""<<endl;                pIWbemServices->Release();                pIWbemLocator->Release();                CoUninitialize();                return hRet;        }        bstr_t strQueryLanguage("WQL");        bstr_t strQuery("SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'");        IEnumWbemClassObject *pIEnumWbemClassObject = NULL;        hRet = pIWbemServices->ExecNotificationQuery(strQueryLanguage, strQuery, WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pIEnumWbemClassObject);        if (SUCCEEDED(hRet))        {                do                 {                        ULONG uReturned = 0;                        IWbemClassObject *pIWbemClassObject = NULL;                        hRet = pIEnumWbemClassObject->Next(WBEM_INFINITE, 1, &pIWbemClassObject, &uReturned);                        if (SUCCEEDED(hRet) && pIWbemClassObject)                        {                                VARIANT vtInstanceObject;                                hRet = pIWbemClassObject->Get(_T("TargetInstance"), 0, &vtInstanceObject, NULL, NULL);                                if (SUCCEEDED(hRet) && vtInstanceObject.vt == VT_UNKNOWN && vtInstanceObject.punkVal != NULL)                                {                                        IWbemClassObject *pTargetInstance = (IWbemClassObject*)vtInstanceObject.punkVal;                                        VARIANT vtProcessID, vtExecutablePath;                                        // 获取进程ID                                        hRet = pTargetInstance->Get(_T("ProcessID"), 0, &vtProcessID, NULL, NULL);                                        if (SUCCEEDED(hRet))                                        {                                                // 获取进程名                                                hRet = pTargetInstance->Get(_T("Name"), 0, &vtExecutablePath, NULL, NULL);                                                if (SUCCEEDED(hRet))                                                {                                                        wchar_t pName[MAX_PATH] = {0};                                                        wsprintf(pName, L"%s", vtExecutablePath.bstrVal);                                                        _wcsupr_s(pName, MAX_PATH);                                                        wcout<<L"ProcessName:"<<pName<<L"  ProcessId:"<<vtProcessID.ulVal<<" is started..."<<endl;                                                }                                        }                                        vtInstanceObject.punkVal->Release();                                }                        }                } while (TRUE);        }        pIWbemServices->Release();        pIWbemLocator->Release();        CoUninitialize();        return 0;}
0 0