[DllImport("kernel32")] public extern static int OpenProcess(int access, bool inherit, int pid); [DllImport("kernel32.dll", SetLastError = true)] public static extern bool ReadProcessMemory(IntPtr hProcess, UIntPtr lpBaseAddress, [Out] byte[] lpBuffer, int dwSize, IntPtr lpNumberOfBytesRead); ManagementEventWatcher processStartEvent = new ManagementEventWatcher("SELECT * FROM Win32_ProcessStartTrace"); public Service1() { InitializeComponent(); processStartEvent.EventArrived += new EventArrivedEventHandler(processStartEvent_EventArrived); processStartEvent.Start(); } public async void processStartEvent_EventArrived(object sender, EventArrivedEventArgs e) { try { string processName = e.NewEvent.Properties["ProcessName"].Value.ToString(); string processID = Convert.ToInt32(e.NewEvent.Properties["ProcessID"].Value).ToString(); int pid = Convert.ToInt32(e.NewEvent.Properties["ProcessID"].Value); Process p = Process.GetProcessById(pid); string wholeFileName = p.MainModule.FileName; await AnalyzeStartup(wholeFileName, p); } catch { } }
var
This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)