ring3下利用WMI监视进程创建(vc版)

[cpp] view plain copy

1. #include "stdafx.h"
2. #define _WIN32_DCOM
3. #include <iostream>
4. using namespace std;
5. #include <comdef.h>
6. #include <Wbemidl.h>
7. # pragma comment(lib, "wbemuuid.lib")
8. int main(int argc, char **argv)
9. {
10. HRESULT hres;
11. hres =  CoInitializeEx(0, COINIT_MULTITHREADED);
12. if (FAILED(hres))
13. {
14. cout << "Failed to initialize COM library. "
15. << "Error code = 0x"
16. << hex << hres << endl;
17. return 1;
18. }
19. IWbemLocator *pLoc = 0;
20. HRESULT hr;
21. hr = CoCreateInstance(CLSID_WbemLocator, 0,
22. CLSCTX_INPROC_SERVER, IID_IWbemLocator, (LPVOID *) &pLoc);
23. if (FAILED(hr))
24. {
25. cout << "Failed to create IWbemLocator object. Err code = 0x"
26. << hex << hr << endl;
27. return hr;     // Program has failed.
28. }
29. IWbemServices *pSvc = 0;
30. bstr_t strNetworkResource("ROOT\\CIMV2");
31. hr = pLoc->ConnectServer(
32. strNetworkResource,
33. NULL, NULL, 0, NULL, 0, 0, &pSvc);
34. if (FAILED(hr))
35. {
36. cout << "Could not connect. Error code = 0x"
37. << hex << hr << endl;
38. pLoc->Release();
39. CoUninitialize();
40. return hr;      // Program has failed.
41. }
42. cout << "Connected to WMI" << endl;
43. // Set the proxy so that impersonation of the client occurs.
44. hr = CoSetProxyBlanket(pSvc,
45. RPC_C_AUTHN_WINNT,
46. RPC_C_AUTHZ_NONE,
47. NULL,
48. RPC_C_AUTHN_LEVEL_CALL,
49. RPC_C_IMP_LEVEL_IMPERSONATE,
50. NULL,
51. EOAC_NONE
52. );
53. if (FAILED(hr))
54. {
55. cout << "Could not set proxy blanket. Error code = 0x"
56. << hex << hr << endl;
57. pSvc->Release();
58. pLoc->Release();
59. CoUninitialize();
60. return hr;
61. }
62. bstr_t strLang("WQL");
63. //监视taskmgr.exe进程创建
64. bstr_t strQuery("SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA ‘Win32_Process‘ AND TargetInstance.Name = ‘taskmgr.exe‘");
65. IEnumWbemClassObject* pResult = NULL;
66. hr = pSvc->ExecNotificationQuery(strLang, strQuery, WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pResult);
67. if(SUCCEEDED(hr))
68. {
69. do{
70. IWbemClassObject* pObject = NULL;
71. ULONG lCnt = 0;
72. hr = pResult->Next(WBEM_INFINITE, 1, &pObject, &lCnt);
73. if(SUCCEEDED(hr) && pObject)
74. {
75. cout<<"taskmgr.exe进程已创建"<<endl;
76. break; //退出
77. }
78. }while(true);
79. }
80. pSvc->Release();
81. pLoc->Release();
82. CoUninitialize();
83. CoUninitialize();
84. return 0;   // Program successfully completed.
85. }

http://blog.csdn.net/zwfgdlc/article/details/6613605