文件名称:CreateProcessNotify
- 所属分类：
- 系统编程
- 资源属性：
- [Windows] [Visual C] [源码]
- 上传时间：
- 2014-07-09
- 文件大小：
- 34kb
- 下载次数：
- 0次
- 提 供 者：
- sir****
- 相关连接：
- 无
- 下载说明：
- 别用迅雷下载，失败请重下，重下不扣分！
介绍说明－－下载内容均来自于网络，请自行研究使用
NT/2K provides a set of APIs, known as "Process Structure Routines" [2] exported by NTOSKRNL. One of these APIs PsSetCreateProcessNotifyRoutine() offers the ability to register system-wide callback function which is called by OS each time when a new process starts, exits or is terminated. The mentioned API can be employed as an easy to implement method for tracking down processes simply by implementing a NT kernel-mode driver and a user mode Win32 control application. The role of the driver is to detect process execution and notifiy the control program about these events.
(系统自动生成,下载前可以参看下载内容)
下载文件列表
CreateProcessNotify
...................\Code
...................\....\ConsCtl
...................\....\.......\ApplicationScope.cpp
...................\....\.......\ApplicationScope.h
...................\....\.......\CallbackHandler.cpp
...................\....\.......\CallbackHandler.h
...................\....\.......\Common.h
...................\....\.......\ConsCtl.cpp
...................\....\.......\ConsCtl.dsp
...................\....\.......\CustomThread.cpp
...................\....\.......\CustomThread.h
...................\....\.......\LockMgr.cpp
...................\....\.......\LockMgr.h
...................\....\.......\NtDriverController.cpp
...................\....\.......\NtDriverController.h
...................\....\.......\QueueContainer.cpp
...................\....\.......\QueueContainer.h
...................\....\.......\QueuedItem.h
...................\....\.......\RetrievalThread.cpp
...................\....\.......\RetrievalThread.h
...................\....\.......\ThreadMonitor.cpp
...................\....\.......\ThreadMonitor.h
...................\....\.......\WinUtils.h
...................\....\ProcMon.dsw
...................\....\ProcObsrv
...................\....\.........\ProcObsrv.c
...................\....\.........\ProcObsrv.dsp
...................\Output
...................\......\ProcObsrv.sys