查找有关使用 .NET 代码防止进程生成的 CodeProject 文章
我记得很久以前在我认为 CodeProject 上看到过一篇关于防病毒或反恶意软件的文章，有人在其中编写了他连接到 Windows API 的文章，以便能够在新进程启动时捕获并在允许该进程之前提示用户开始。
我再也找不到这篇文章了，而且实际上希望能够实现这样的东西。目前，我们有一个基于 Gecko 构建的自定义浏览器，我们已根据内部员工安全级别等集成了对站点的访问限制。我们阻止任何其他浏览器使用计时器运行并从进程调用 Process.GetProcessesByName()我们不允许的浏览器列表。
我们想要完成的是，我们希望能够显示一个对话框，而不是仅仅阻止这些浏览器（在其他浏览器启动和被我们的服务终止之间存在很小的延迟），我们希望能够显示一个对话框，而不是在全部，解释该程序不在允许的列表中。这样，我们可以生成“允许”进程的列表，并阻止其他所有进程（我们还没有遇到安装外部应用程序的问题，但你永远不会太小心）。
不幸的是，我们没有使用 C# 进行太多 Windows API 编程，因此我不确定从哪里开始寻找我们需要挂钩的调用。
即使只是阅读内容的起点也会有所帮助。
I remember coming across an article on I think CodeProject quite some time ago regarding an antivirus or antimalware some guy was writing where he hooked into the Windows API to be able to catch whenever a new process was started and was prompting he user before allowing the process to start.
I can no longer find the article, and would actually like to be able to implement something like this. Currently, we have a custom browser built on Gecko that we've integrated access restrictions to sites based on our internal employee security levels, etc. We prevent any other browser from running with a timer and a call to Process.GetProcessesByName() from a list of the browsers we don't allow.
What we want to accomplish is, instead of just blocking these browsers, where there is a small delay between the other browser starting and it being killed by our service, we'd like to be able to display a dialog instead of the process launching at all, explaining that the program isn't in the allowed list. This way, we can generate a list of "allowed" processes and just block everything else (we haven't yet had a problem with outside apps being installed, but you can never be too careful).
Unfortunately, we don't do much Windows API programming from C#, so I'm not sure where to begin looking for what calls we need to hook.
Even just a starting point of what to read up on would be helpful.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我猜你指的是这篇文章：挂钩本机 API 并在系统范围内控制进程创建基础
I guess you mean this article: Hooking the native API and controlling process creation on a system-wide basis