C# 挂钩 Windows 进程以检查调试进程
我想知道是否有一种方法可以挂接 Windows 进程来检查是否有任何可疑程序正在运行，例如（Wireshark、Fiddler、OllyDBG 等）。
我想挂钩 Windows 进程，以便在检测到不需要的进程时关闭客户端或实时弹出消息。
如果你们能为我提供任何执行此操作的链接，那就太好了。
谢谢！
I was wondering if there is a way I could hook the windows processes to check if any suspicious programs are running like (Wireshark, Fiddler, OllyDBG, etc).
I want to hook the windows processes so it will close the client or pop-up a message in real time when it detects a unwanted process.
If you guys can provide me with any links to doing this that would be nice.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
然后遍历列表并根据需要执行您不想运行的应用程序。
Then walk the list and do as desired for your apps you do not want to run.
您可以使用
Win32_Process。每个进程都会创建一个Win32_Process实例，因此查看新实例将告诉您（近乎）实时的进程创建情况。要接收 WMI 创建事件，请参阅此页面：http://msdn。 microsoft.com/en-us/library/system.management.eventquery.aspx（编辑：不同的链接，现在以 C# 为例）。
You can detect process creations by using WMI creation events for
Win32_Process. An instance ofWin32_Processis created with each process, so looking new instances will tell you about process creation in (near) real time.To receive WMI creation events see this page: http://msdn.microsoft.com/en-us/library/system.management.eventquery.aspx (EDIT: different link, now to sample in C#).
EnumWindows 枚举所有顶级窗口。
而且您不想将 C# dll 注入其他进程。这需要将 .net 运行时加载到该进程中。这会浪费 RAM，并且如果该进程是使用不同版本的 .net 的 .net 应用程序，则会出现版本控制问题。特别是如果您的 dll 在进程加载其自己的 .net 版本之前被注入。
您希望通过注入从外部无法实现的流程来实现什么？
EnumWindows enumerates all top level windows.
And you don't want to inject a C# dll into other processes. This requires the .net runtime to be loaded into that process. This wastes RAM, and if the process is a .net app using a different version of .net then there are versioning problems. Especially if your dll is injected before the process loads its own version of .net.
And what to you want to achieve by injecting into that process you can't achieve from the outside?
您可能想查看 CodePlex 上的 EasyHook (http://easyhook.codeplex.com)。 这里是一些讨论，据报道人们已经能够挂钩 CreateProcess。如果您设法连接到该 API 函数，您就可以在创建时知道创建的进程。
You might want to check out EasyHook on CodePlex (http://easyhook.codeplex.com). Here is some discussion where people reportedly have been able to hook into CreateProcess. If you manage to hook into that API function you know of the created process at creation time.