Click here to Skip to main content
15,892,005 members
Articles / Programming Languages / C++

Detecting Windows NT/2K process execution

Rate me:
Please Sign up or sign in to vote.
4.94/5 (69 votes)
25 Mar 2002CPOL7 min read 1.1M   11.4K   233  
An article on how to get notification from the OS when a process starts
//---------------------------------------------------------------------------
//
// WinUtils.h
//
// SUBSYSTEM:   
//              Monitoring process creation and termination  
//				
// DESCRIPTION: Common header 
//             
// AUTHOR:		Ivo Ivanov
//
//---------------------------------------------------------------------------
#if !defined(_WINUTILS_H_)
#define _WINUTILS_H_

#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000

//---------------------------------------------------------------------------
//
// Includes
//
//---------------------------------------------------------------------------
#include "Common.h"
#include <tchar.h>

//---------------------------------------------------------------------------
// ReplaceFileName
//
//---------------------------------------------------------------------------
static BOOL ReplaceFileName(
	TCHAR* pszOldFileName,
	TCHAR* pszBaseNewFileName,
	TCHAR* pszNewFileName
	)
{
	BOOL  bResult = TRUE;
	TCHAR *pdest;
	_TINT   ch = TEXT('\\');
	::ZeroMemory((PBYTE)pszNewFileName, sizeof(MAX_PATH));
	_tcscpy(pszNewFileName, pszOldFileName);
	// Search backward and replaces the dll name with the hook one
	pdest = _tcsrchr(pszNewFileName, ch);
	if( pdest != NULL )
		_tcscpy(&pdest[1], pszBaseNewFileName);
	else
		_tcscpy(pszNewFileName, pszBaseNewFileName);

	return bResult;
}

//---------------------------------------------------------------------------
// GetProcessHostFullName
//
// Return the path and the name of the current process
//---------------------------------------------------------------------------
static BOOL GetProcessHostFullName(TCHAR* pszFullFileName)
{
	DWORD dwResult = 0;
	::ZeroMemory((PBYTE)pszFullFileName, MAX_PATH);
	dwResult = ::GetModuleFileName(
		NULL,                   // handle to module
		pszFullFileName,        // file name of module
		MAX_PATH                // size of buffer
		);

	return (dwResult != 0);
}

//---------------------------------------------------------------------------
// VerifyIsWindowsNtRequired
//
// Verify the OS and current OS doesn't meet the requirement it exits
//---------------------------------------------------------------------------
static void VerifyIsWindowsNtRequired() 
{
	OSVERSIONINFO vi = { sizeof(vi) };
	::GetVersionEx(&vi);
	if (vi.dwPlatformId != VER_PLATFORM_WIN32_NT) 
		::ExitProcess(0);
}


#endif // !defined(_WINUTILS_H_)

//--------------------- End of the file -------------------------------------

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
United States United States
I specialize in OS Internals and Reverse Engineering.
Before joining my current employer I used to run a security blog for malware analysis: http://vinsula.com/security-blog

Comments and Discussions