Hi !

Does anyone know an easy way to detect the startup of a certain programm?
For example I select Notepad from my startmenu and a msgbox should pop up with

"c:\winnt\notepad.exe" launched!

It would be enough if this will run in 2k/XP. Thought about hooking CreateProcess. Any other idea?

Posted on 2002-05-01 12:30:05 by bazik
Posted on 2002-05-01 12:57:00 by Hiroshimator
Thanks Hiro. Anyone knows another way?
Posted on 2002-05-01 17:56:00 by bazik
Check the debug APIs, i am sure there is a callback/message you can receive when a new process starts up, you could then get info on that process.
Posted on 2002-05-01 18:54:08 by sluggy
Thanks Hiro. Anyone knows another way?

You can try register hooking method, it's quite easy to implement but it will not catch 100% of exes. (i.e. those who are launched by CreateProcess)
Posted on 2002-05-01 21:42:12 by Axial
You can implement a "shell execute hook".

See attached example. Function "Execute" in exechook.asm is the interesting part, the rest is COM bureaucracy.
Posted on 2002-05-01 23:43:46 by japheth
By the way, is there any way to create a process (not a thread) without having to have already an EXE on the disk?
Posted on 2002-05-02 04:34:40 by Maverick