该工具来自 codeproject，使用 PSAPI 获取内核模式和用户模式进程并将用户模式进程的启动时间和结束时间记入日志。本文工具程序名为 ProcessTime。运行程序后，它启动一个线程，该线程在后台执行每隔一定时间监控是否有新启动进程或退出进程。

象。-The instrument from codeproject, use PSAPI access to kernel mode and user mode processes and user-mode process start time and end time credited to the log. In this paper, the procedure known as instrument ProcessTime. After running the program, it starts a thread, the thread in the background to monitor the implementation of every time it must have a new boot process, or exit the process. Like.