如何找到用户刚刚启动的可执行文件？
我正在开发一个测试框架，该框架需要能够记录用户的活动，然后重播它们。我可以使用 P/Invoke 周围的 ManagedWinAPI 包装器（在 C# 中工作）来记录鼠标和键盘活动，这很有效，但我认为为了使记录更有用，我需要更多地了解用户启动时发生的情况一个应用程序。
我不知道的是如何找到一个刚刚启动的应用程序以及它是什么应用程序。因此，假设用户启动我的记录应用程序，然后转到开始菜单并单击“Paint”，我希望能够将“Paint.exe”启动记录为一个事件（或者如果他们单击传递一些参数的快捷方式）这将是该快捷方式的值，包括参数），因为如果我想在不同的机器上播放录音，菜单项可能位于不同的位置，因此鼠标活动可能具有欺骗性。
我需要遵循什么路线来获取这些数据？我无法找到术语，所以我什至没有真正将正确的内容放入搜索引擎......
I'm working on a testing framework that needs to be able to record a user's activities and then replay them. I'm fine using the ManagedWinAPI wrappers around P/Invoke ( working in C# ) to record mouse and keyboard activity, which works but I think that in order to make the recording more useful I need to know more about what happens when the user starts an application.
What I don't know is how to find that an application has just been started and what application it was. So supposing the user started my recording application then went over to the start menu and clicked on "Paint" I would like to be able to record "Paint.exe" starting up as an event ( or if they clicked a shortcut that passed some parameters it would be the value of that shortcut including the parameters ) because if I want to play back the recording on a different machine menu items may be in different places so the mouse activity could be deceptive.
What route do I need to be following to acquire this data? I haven't been able to find the terminology so I've not even really got the right things to put into a search engine...
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
工具帮助库可以拍摄快照当前进程。稍后可以将其与另一个快照进行比较。但是，正如 No Refunds No Returns 所评论的那样，此方法无法确定是否是启动该过程的用户操作。
The Tool Help Library can take a snapshot of the current processes. This can later be compared to another snapshot. But, just as No Refunds No Returns commented, this method cannot determine if it was a user action that started the process.
执行此操作的正确方法是编写驱动程序并使用进程管理器回调在每次创建进程时获取通知。如果您不想这样做，可以使用 EasyHook 等托管挂钩库并挂钩 NtCreateThread/NtCreateThreadEx。如果您不想这样做，那么您只需轮询新进程即可。
编辑：确定用户是否启动特定进程还需要您遍历堆栈。在内核模式下，您可以使用 RtlWalkFrameChain，而在用户模式下，您可以使用 CaptureStackBackTrace。
编辑2：请参阅 PsSetCreateProcessNotifyRoutine 和 PsSetCreateProcessNotifyRoutineEx。
The proper way to do this is to write a driver and use process manager callbacks to get a notification each time a process is created. If you don't want to do that, you can use a managed hooking library like EasyHook and hook NtCreateThread/NtCreateThreadEx. If you don't want to do that, then you'll just have to poll for new processes.
EDIT: Determining whether the user started a particular process would also require you to walk the stack. In kernel-mode you can use RtlWalkFrameChain while in user-mode you can use CaptureStackBackTrace.
EDIT 2: See PsSetCreateProcessNotifyRoutine and PsSetCreateProcessNotifyRoutineEx.