6

I need to know (preferably with the least latency) when foo.exe is launched.

Right now, I have a thread that sits in a light loop (~10 Hz) and walks the process tree looking foo.exe.

This is less than elegant and I was wondering whether I could register with some part of the Windows API to get a callback when any process starts.

If no such facility is available, I am, of course, open to other methods of accomplishing this task more elegantly.

NSWO2
  • 63
  • 1
  • 3
  • And what if someone renames a copy of foo.exe? What are you really trying to accomplish here? – bmargulies Dec 16 '09 at 17:17
  • 1
    They won't. This app solves a *very* specific problem. Basically making a legacy app work with modern peripherals. – NSWO2 Dec 16 '09 at 17:32

2 Answers2

5

You can register yourself as a debugger for foo.exe through the Image File Execution Options. Anytime the system needs to launch foo.exe, it'll launch your app and pass foo.exe and its parameters to you. You will have to start the process yourself.

Note: as usual, some words of caution by Raymond Chen.

You can also set a system-wide message hook and for each new process your dll gets loaded, check if it's the one you care you just pass through, for foo.exe you notify yourself and then pass through. Unfortunately, that means you will be injecting your code in each process and you will be hurting the system perf a little bit. Not to mention that you can actually hose everybody if you have a bug in your code.

rakosmanjr
  • 100
  • 1
  • 2
  • 8
Franci Penov
  • 74,861
  • 18
  • 132
  • 169
  • Cool, IFEO looks promising. As for the system-assisted hooking, I agree. It was one of the first things that I thought of but decided it wasn't worth the hit. I'll get back to this shortly. – NSWO2 Dec 16 '09 at 17:25
1

Possible options:

Is foo.exe under your control? If so modify the source code to send a signal.

Is foo.exe not under your control? Write an injection DLL and have it send a signal when it's loaded into the process with the right name.

Don Neufeld
  • 22,720
  • 11
  • 51
  • 50
  • Thanks for the reply don. Funnily enough, my app itself injects into foo.exe. ;) I originally thought about global injection (i.e., system-assisted), but that means that the system would needlessly load my dll into *all* processes. Static IAT patching also won't work in this particular case. I was thinking there had to be an easier way short of using PsSetCreateProcessNotifyRoutine. – NSWO2 Dec 16 '09 at 17:22