private static void ReportProperty(string name, PreciseValue <string> value, ConsoleColor valueColor = ConsoleColor.White)
{
var valueString = value.Value ?? "[UNKNOWN]";
var reportedValue = value.IsPrecise ? valueString : $"(?) {valueString}";
ReportProperty(name, reportedValue, value.IsPrecise ? valueColor : ConsoleColor.Gray);
}
public static IDisposable StartNew(Action <ProcessInfo> handler)
{
var watcher = new ManagementEventWatcher(
new WqlEventQuery("select * from Win32_ProcessStartTrace"));
watcher.EventArrived += (_, e) =>
{
var properties = e.NewEvent.Properties;
var processId = Convert.ToUInt32(properties["ProcessID"].Value);
var commandLine = GetProcessCommandLine(processId);
var processName = Convert.ToString(properties["ProcessName"].Value);
var processInfo = new ProcessInfo
{
ProcessId = processId,
ProcessName = processName !,
CommandLine = PreciseValue.Imprecise(commandLine)
};
handler(processInfo);
};
watcher.Start();
return(watcher);
}
}
public static IDisposable StartNew(Action <ProcessInfo> handler)
{
var watcher = new ManagementEventWatcher(
new WqlEventQuery(@"select * from __InstanceCreationEvent within 1 where TargetInstance isa 'Win32_Process'"));
watcher.EventArrived += (_, e) =>
{
var process = (ManagementBaseObject)e.NewEvent["TargetInstance"];
var processId = Convert.ToUInt32(process.Properties["ProcessID"].Value);
var processName = Convert.ToString(process.Properties["Name"].Value);
var commandLine = Convert.ToString(process.Properties["CommandLine"].Value);
var processInfo = new ProcessInfo
{
ProcessId = processId,
ProcessName = processName !,
CommandLine = PreciseValue.Precise(commandLine)
};
handler(processInfo);
};
watcher.Start();
return(watcher);
}
}