Click here to Skip to main content
Click here to Skip to main content
Add your own
alternative version

Detecting Windows NT/2K process execution

, 25 Mar 2002 CPOL
An article on how to get notification from the OS when a process starts
//---------------------------------------------------------------------------
//
// Common.h
//
// SUBSYSTEM:   
//              Monitoring process creation and termination  
//				
// DESCRIPTION: Common header 
//             
// AUTHOR:		Ivo Ivanov
//
//---------------------------------------------------------------------------
#if !defined(_COMMON_H_)
#define _COMMON_H_

#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000

//-----------------------Windows Version Build Option -----------------------

#define _WIN32_WINNT 0x0500

//---------------------------Unicode Build Option ---------------------------

// To compile using Unicode on the x86 CPU, uncomment the line below.
#define UNICODE

// When using Unicode Windows functions, use Unicode C-Runtime functions too.
#ifdef UNICODE
#define _UNICODE
#endif
//---------------------------------------------------------------------------
//
// Includes
//
//---------------------------------------------------------------------------
#include <windows.h>


//---------------------------------------------------------------------------
//
// struct _QueuedItem
//
//---------------------------------------------------------------------------
typedef struct _QueuedItem  
{
	HANDLE  hParentId;
    HANDLE  hProcessId;
    BOOLEAN bCreate;
} QUEUED_ITEM, *PQUEUED_ITEM;


#endif // !defined(_COMMON_H_)

//--------------------- End of the file -------------------------------------

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

Ivo Ivanov
Chief Technology Officer Vinsula
Australia Australia
I specialise in Malware Analysis, Application Security, Windows Kernel, x86/x64, and Reverse Engineering.
My blog: http://vinsula.com/security-blog
http://vinsula.com/
http://www.infoprocess.com.au
Follow on   Twitter   LinkedIn

| Advertise | Privacy | Terms of Use | Mobile
Web01 | 2.8.1411023.1 | Last Updated 26 Mar 2002
Article Copyright 2002 by Ivo Ivanov
Everything else Copyright © CodeProject, 1999-2014
Layout: fixed | fluid