ring3下利用WMI监视进程创建(vc版)

[cpp] view plain copy

 

#include "stdafx.h"
#define _WIN32_DCOM
#include <iostream>
using namespace std;
#include <comdef.h>
#include <Wbemidl.h>

# pragma comment(lib, "wbemuuid.lib")

int main(int argc, char **argv)
{
    HRESULT hres;

    hres =  CoInitializeEx(0, COINIT_MULTITHREADED);
    if (FAILED(hres))
    {
        cout << "Failed to initialize COM library. "
            << "Error code = 0x"
            << hex << hres << endl;
        return 1;
    }

    IWbemLocator *pLoc = 0;
    HRESULT hr;

    hr = CoCreateInstance(CLSID_WbemLocator, 0,
        CLSCTX_INPROC_SERVER, IID_IWbemLocator, (LPVOID *) &pLoc);

    if (FAILED(hr))
    {
        cout << "Failed to create IWbemLocator object. Err code = 0x"
            << hex << hr << endl;
        return hr;     // Program has failed.
    }

    IWbemServices *pSvc = 0;

    bstr_t strNetworkResource("ROOT\CIMV2");

    hr = pLoc->ConnectServer(
        strNetworkResource,
        NULL, NULL, 0, NULL, 0, 0, &pSvc);

    if (FAILED(hr))
    {
        cout << "Could not connect. Error code = 0x"
            << hex << hr << endl;
        pLoc->Release();
        CoUninitialize();
        return hr;      // Program has failed.
    }

    cout << "Connected to WMI" << endl;

    // Set the proxy so that impersonation of the client occurs.
    hr = CoSetProxyBlanket(pSvc,
        RPC_C_AUTHN_WINNT,
        RPC_C_AUTHZ_NONE,
        NULL,
        RPC_C_AUTHN_LEVEL_CALL,
        RPC_C_IMP_LEVEL_IMPERSONATE,
        NULL,
        EOAC_NONE
        );

    if (FAILED(hr))
    {
        cout << "Could not set proxy blanket. Error code = 0x"
            << hex << hr << endl;
        pSvc->Release();
        pLoc->Release();
        CoUninitialize();
        return hr;
    }


    bstr_t strLang("WQL");
    //监视taskmgr.exe进程创建
    bstr_t strQuery("SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'taskmgr.exe'");
    IEnumWbemClassObject* pResult = NULL;

    hr = pSvc->ExecNotificationQuery(strLang, strQuery, WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pResult);
    if(SUCCEEDED(hr))
    {
        do{
            IWbemClassObject* pObject = NULL;
            ULONG lCnt = 0;
            hr = pResult->Next(WBEM_INFINITE, 1, &pObject, &lCnt);
            if(SUCCEEDED(hr) && pObject)
            {
                cout<<"taskmgr.exe进程已创建"<<endl;
                break; //退出
            }
        }while(true);
    }



    pSvc->Release();
    pLoc->Release();
    CoUninitialize();
    CoUninitialize();

    return 0;   // Program successfully completed.
}

http://blog.csdn.net/zwfgdlc/article/details/6613605