检测进程创建
我需要检测第三方 .NET 应用程序的进程创建。我的目标是注入一个插件 DLL 来增强该应用程序的功能。我希望尽早注入它，这样我就可以捕获应用程序的初始化事件。有没有办法检测这个进程何时创建并在调用 Main 之前注入 DLL？
I need to detect process creation of a third-party .NET application. My goal is to inject a plugin DLL to enhance functionality of this application. I would prefer to inject this as early as possible so I can catch the application's initialization events. Is there any way to detect when this process is created and inject the DLL before Main is called?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
通常的解决方案是用存根替换目标应用程序映像，该存根在受控参数下启动原始映像。
还有其他方法，例如 GFlags，但它们旨在用于调试不适用于正常操作。
The usual solution is to replace the targeted application image with a stub that launches the original image under controlled parameters.
There are other ways, like GFlags, but they're intended for debugging not for normal operations.
如果您无法按照 Remus 的建议替换原始应用程序，您可能需要考虑使用系统级挂钩并拦截 CreateProcess() API 系列函数并监视它们的所有调用。
请参阅：API 挂钩揭示
这有点复杂，您可能会遇到各种各样的问题问题，例如 vista 和其他挂钩库的问题：
http://forum.madshi.net/viewtopic.php?p=15833
If you can't replace the original application as Remus suggested, you might want to look into using a system level hook and intercept CreateProcess() API family functions and monitor all their invocations.
See : API hooking revealed
It's a bit complicated and you might run into all sorts of problems, such as problems on vista and with other hooking libraries:
http://forum.madshi.net/viewtopic.php?p=15833
坏主意。
你可能认为我很严厉，但我已经看到我的进程崩溃了，因为一些小丑认为向其中注入一些随机 DLL 以实现“增强功能”是一个好主意。您可能会破坏其他人地址空间的稳定。停止吧。更重要的是，当你的错误代码搞砸了他们时，他们会受到指责。
允许您将代码注入另一个进程的 API 实际上是为了编写调试器。如果您不编写调试器，请不要在生产代码中使用它们。你这是在玩火。
Bad idea.
You might think I'm being harsh, but I've seen my process crash because some joker thought it was a bright idea to inject some random DLL into it for "enhanced functionality". You are potentially destabilizing everybody else's address spaces. Stop it. What's more, they will get blamed when your bad code screws them over.
The APIs which allow you to inject code into another process are really meant for writing a debugger. If you're not writing a debugger, please do not use them in production code. You are playing with fire.