ring3下利用WMI监视进程创建(vc版)

#include "stdafx.h"
#define _WIN32_DCOM
#include <iostream>
using namespace std;
#include <comdef.h>
#include <Wbemidl.h>

# pragma comment(lib, "wbemuuid.lib")

int main(int argc, char **argv)
{
HRESULT hres;

hres =  CoInitializeEx(0, COINIT_MULTITHREADED);
if (FAILED(hres))
{
cout << "Failed to initialize COM library. "
<< "Error code = 0x"
<< hex << hres << endl;
return 1;
}

IWbemLocator *pLoc = 0;
HRESULT hr;

hr = CoCreateInstance(CLSID_WbemLocator, 0,
CLSCTX_INPROC_SERVER, IID_IWbemLocator, (LPVOID *) &pLoc);

if (FAILED(hr))
{
cout << "Failed to create IWbemLocator object. Err code = 0x"
<< hex << hr << endl;
return hr;     // Program has failed.
}

IWbemServices *pSvc = 0;

bstr_t strNetworkResource("ROOT\\CIMV2");

hr = pLoc->ConnectServer(
strNetworkResource,
NULL, NULL, 0, NULL, 0, 0, &pSvc);

if (FAILED(hr))
{
cout << "Could not connect. Error code = 0x"
<< hex << hr << endl;
pLoc->Release();
CoUninitialize();
return hr;      // Program has failed.
}

cout << "Connected to WMI" << endl;

// Set the proxy so that impersonation of the client occurs.
hr = CoSetProxyBlanket(pSvc,
RPC_C_AUTHN_WINNT,
RPC_C_AUTHZ_NONE,
NULL,
RPC_C_AUTHN_LEVEL_CALL,
RPC_C_IMP_LEVEL_IMPERSONATE,
NULL,
EOAC_NONE
);

if (FAILED(hr))
{
cout << "Could not set proxy blanket. Error code = 0x"
<< hex << hr << endl;
pSvc->Release();
pLoc->Release();
CoUninitialize();
return hr;
}

bstr_t strLang("WQL");
//监视taskmgr.exe进程创建
bstr_t strQuery("SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'taskmgr.exe'");
IEnumWbemClassObject* pResult = NULL;

hr = pSvc->ExecNotificationQuery(strLang, strQuery, WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pResult);
if(SUCCEEDED(hr))
{
do{
IWbemClassObject* pObject = NULL;
ULONG lCnt = 0;
hr = pResult->Next(WBEM_INFINITE, 1, &pObject, &lCnt);
if(SUCCEEDED(hr) && pObject)
{
cout<<"taskmgr.exe进程已创建"<<endl;
break; //退出
}
}while(true);
}

pSvc->Release();
pLoc->Release();
CoUninitialize();
CoUninitialize();

return 0;   // Program successfully completed.
}