当某些进程启动时我可以收到通知吗？
我需要知道（最好以最少的延迟）foo.exe 何时启动。
现在，我有一个线程位于轻循环（~10 Hz）中，并在进程树中查找 foo.exe。
这不太优雅，我想知道是否可以注册 Windows API 的某些部分，以便在任何进程启动时获得回调。
如果没有这样的设施，我当然愿意接受其他更优雅地完成这项任务的方法。
I need to know (preferably with the least latency) when foo.exe is launched.
Right now, I have a thread that sits in a light loop (~10 Hz) and walks the process tree looking foo.exe.
This is less than elegant and I was wondering whether I could register with some part of the Windows API to get a callback when any process starts.
If no such facility is available, I am, of course, open to other methods of accomplishing this task more elegantly.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
可能的选项：
foo.exe 在您的控制之下吗？如果是的话修改源码发送信号。
foo.exe 不在你的控制之下吗？编写一个 注入 DLL 并让它在以正确的名称加载到进程中时发送信号。
Possible options:
Is foo.exe under your control? If so modify the source code to send a signal.
Is foo.exe not under your control? Write an injection DLL and have it send a signal when it's loaded into the process with the right name.
您可以通过图像文件执行选项将自己注册为 foo.exe 的调试器< /a>.每当系统需要启动 foo.exe 时，它都会启动您的应用程序并将 foo.exe 及其参数传递给您。您必须自己开始该过程。
注意：像往常一样，Raymond Chen 提出了一些警告语。
您还可以设置系统范围的消息挂钩 对于您的 dll 加载的每个新进程，请检查它是否是您刚刚通过的进程，对于 foo.exe，您会通知自己然后通过。不幸的是，这意味着您将在每个进程中注入代码，并且会稍微损害系统性能。更不用说，如果您的代码中存在错误，您实际上可以对每个人进行冲洗。
You can register yourself as a debugger for foo.exe through the Image File Execution Options. Anytime the system needs to launch foo.exe, it'll launch your app and pass foo.exe and its parameters to you. You will have to start the process yourself.
Note: as usual, some words of caution by Raymond Chen.
You can also set a system-wide message hook and for each new process your dll gets loaded, check if it's the one you care you just pass through, for foo.exe you notify yourself and then pass through. Unfortunately, that means you will be injecting your code in each process and you will be hurting the system perf a little bit. Not to mention that you can actually hose everybody if you have a bug in your code.