-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathProcessMonitor.cpp
More file actions
109 lines (100 loc) · 2.82 KB
/
ProcessMonitor.cpp
File metadata and controls
109 lines (100 loc) · 2.82 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
// ProcessMonitor.cpp
#include "ProcessMonitor.h"
ULONG ProcessMonitor::AddRef()
{
return InterlockedIncrement(&m_lRef);
}
ULONG ProcessMonitor::Release()
{
LONG lRef = InterlockedDecrement(&m_lRef);
if (lRef == 0)
delete this;
return lRef;
}
HRESULT ProcessMonitor::QueryInterface(REFIID riid, void** ppv)
{
if (riid == IID_IUnknown || riid == IID_IWbemObjectSink)
{
*ppv = (IWbemObjectSink *) this;
AddRef();
return WBEM_S_NO_ERROR;
}
else return E_NOINTERFACE;
}
HRESULT ProcessMonitor::Indicate(long lObjectCount,
IWbemClassObject **apObjArray)
{
HRESULT hres = S_OK;
CComVariant vData = NULL;
CComPtr<IWbemClassObject> pTargetInstance;
CComBSTR bClassPropertyName = L"__CLASS";
CComBSTR bTargetInstancePropertyName = L"TargetInstance";
CComBSTR bProcessName = L"Name";
CComBSTR bProcessId = L"ProcessId";
LPCWSTR lzClass;
LPCWSTR lzProcessName;
DWORD dProcessId;
for (int i = 0; i < lObjectCount; i++)
{
//get the target instance property.
hres = apObjArray[i]->Get(bTargetInstancePropertyName, 0, &vData, 0, 0);
if (SUCCEEDED(hres))
{
//Obtained the TargetInstance property, now query fo the IWBEMCLASSOBJECT interface. CComPtr<IWbemClassObject> pTargetInstance;
IUnknown* str = vData.punkVal;
hres = str->QueryInterface(IID_IWbemClassObject, reinterpret_cast<void**>(&pTargetInstance));
if (SUCCEEDED(hres))
{
//Obtain the process name.
lzProcessName = L"";
hres = pTargetInstance->Get(bProcessName, 0, &vData, 0, 0);
if (SUCCEEDED(hres))
{
lzProcessName = vData.bstrVal;
lzClass = L"";
hres = apObjArray[i]->Get(bClassPropertyName, 0, &vData, 0, 0);
if (SUCCEEDED(hres))
{
lzClass = vData.bstrVal;
if (wcsicmp(lzClass, L"__InstanceCreationEvent") == 0)
{
//A process has been created so we need the process id.
hres = pTargetInstance->Get(bProcessId, 0, &vData, 0, 0);
if (SUCCEEDED(hres))
{
dProcessId = vData.lVal;
if (hNotificationWindow != nullptr)
{
PostMessage(hNotificationWindow, DBJH_PROCESSSTARTED, (WPARAM)lzProcessName, (LPARAM)dProcessId);
}
}
}
else if (wcsicmp(lzClass, L"__InstanceDeletionEvent") == 0)
{
//A process has been terminated.
if (hNotificationWindow != nullptr)
{
PostMessage(hNotificationWindow, DBJH_PROCESSTERMINATED, (WPARAM)lzProcessName, 0);
}
}
}
}
}
}
}
return WBEM_S_NO_ERROR;
}
HRESULT ProcessMonitor::SetStatus(
/* [in] */ LONG lFlags,
/* [in] */ HRESULT hResult,
/* [in] */ BSTR strParam,
/* [in] */ IWbemClassObject __RPC_FAR *pObjParam
)
{
return WBEM_S_NO_ERROR;
}
void ProcessMonitor::SetProcessNotificationWindow(HWND window)
{
hNotificationWindow = window;
}
// end of ProcessMonitor.cpp