希望编写自己的“应用程序白名单工具”像 Bit9 这样的东西？
在尝试了我可能实际使用的项目想法后，我想我可能会尝试用 C# 或 Python 编写自己的简单版本的 Bit9 Parity。我的问题是执行此操作的最佳方法是什么。我已经用谷歌搜索了 .Net 功能以防止进程执行，但我还没有真正找到我正在寻找的东西。我想做的是监视整个系统内存，并拒绝启动任何进程或应用程序，除非在列表中明确标识。 ProcessWatcher 引起了我的注意，但这不是针对特定进程 ID 的。如何阻止所有其他进程启动？这在.Net 中可能吗？那么蟒蛇呢？
Playing around with project ideas that I might actually use, figured I might try to write my own simple version of Bit9 Parity, in either C# or Python. My question is what is the best way to go about doing this. I've googled .Net functionality for prevent processes from executing, but I havn't really found what I'm looking for. What I'd like to do is monitory the system memory as a whole, and deny any process or application from starting unless specifically identified in a list. ProcessWatcher caught my eye, but is that not for a specific process ID. How do I block ALL other processes from starting? Is this possible in .Net? What about python?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
此
博客文章（使用WMI监控. NET）展示了如何做到这一点。通过一些更改，您应该能够准确地完成您想要的操作。This
blog post(Using WMI to monitor process creation, deletion and modification in .NET) shows how to do that. With a few changes, you should be able to do exactly what you want.深奥、神秘的操作系统 API 魔力。毕竟，您正在干扰操作系统的工作方式。因此，您必须修补或连接到操作系统本身。
它不涉及时间旅行、反重力或永动机。这是可以做到的。
问题在于弄清楚 (1) 需要哪些操作系统 API 调用才能将新挂钩放入操作系统中，以及 (2) 实现从操作系统到代码的调用。
Deep, mysterious OS API magic. After all, you're interfering with how the OS works. You must, therefore patch or hook into the OS itself.
It doesn't involve time-travel, anti-gravity or perpetual motion. It can be done.
It's a matter of figuring out (1) which OS API calls are required to put your new hook into the OS, and (2) implementing a call from the OS to your code.