ring3下利用WMI监视进程创建(vc版)

[cpp] view plain copy

#include "stdafx.h"

#define _WIN32_DCOM

#include <iostream>

using namespace std;

#include <comdef.h>

#include <Wbemidl.h>

# pragma comment(lib, "wbemuuid.lib")

int main(int argc, char **argv)

{

HRESULT hres;

hres = CoInitializeEx(0, COINIT_MULTITHREADED);

if (FAILED(hres))

{

cout << "Failed to initialize COM library. "

<< "Error code = 0x"

<< hex << hres << endl;

return 1;

}

IWbemLocator *pLoc = 0;

HRESULT hr;

hr = CoCreateInstance(CLSID_WbemLocator, 0,

CLSCTX_INPROC_SERVER, IID_IWbemLocator, (LPVOID *) &pLoc);

if (FAILED(hr))

{

cout << "Failed to create IWbemLocator object. Err code = 0x"

<< hex << hr << endl;

return hr; // Program has failed.

}

IWbemServices *pSvc = 0;

bstr_t strNetworkResource("ROOT\\CIMV2");

hr = pLoc->ConnectServer(

strNetworkResource,

NULL, NULL, 0, NULL, 0, 0, &pSvc);

if (FAILED(hr))

{

cout << "Could not connect. Error code = 0x"

<< hex << hr << endl;

pLoc->Release();

CoUninitialize();

return hr; // Program has failed.

}

cout << "Connected to WMI" << endl;

// Set the proxy so that impersonation of the client occurs.

hr = CoSetProxyBlanket(pSvc,

RPC_C_AUTHN_WINNT,

RPC_C_AUTHZ_NONE,

NULL,

RPC_C_AUTHN_LEVEL_CALL,

RPC_C_IMP_LEVEL_IMPERSONATE,

NULL,

EOAC_NONE

);

if (FAILED(hr))

{

cout << "Could not set proxy blanket. Error code = 0x"

<< hex << hr << endl;

pSvc->Release();

pLoc->Release();

CoUninitialize();

return hr;

}

bstr_t strLang("WQL");

//监视taskmgr.exe进程创建

bstr_t strQuery("SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'taskmgr.exe'");

IEnumWbemClassObject* pResult = NULL;

hr = pSvc->ExecNotificationQuery(strLang, strQuery, WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pResult);

if(SUCCEEDED(hr))

{

do{

IWbemClassObject* pObject = NULL;

ULONG lCnt = 0;

hr = pResult->Next(WBEM_INFINITE, 1, &pObject, &lCnt);

if(SUCCEEDED(hr) && pObject)

{

cout<<"taskmgr.exe进程已创建"<<endl;

break; //退出

}

}while(true);

}

pSvc->Release();

pLoc->Release();

CoUninitialize();

CoUninitialize();

return 0; // Program successfully completed.

}
http://blog.csdn.net/zwfgdlc/article/details/6613605