Beispiel #1
0
        private static void ReportProperty(string name, PreciseValue <string> value, ConsoleColor valueColor = ConsoleColor.White)
        {
            var valueString   = value.Value ?? "[UNKNOWN]";
            var reportedValue = value.IsPrecise ? valueString : $"(?) {valueString}";

            ReportProperty(name, reportedValue, value.IsPrecise ? valueColor : ConsoleColor.Gray);
        }
        public static IDisposable StartNew(Action <ProcessInfo> handler)
        {
            var watcher = new ManagementEventWatcher(
                new WqlEventQuery("select * from Win32_ProcessStartTrace"));

            watcher.EventArrived += (_, e) =>
            {
                var properties  = e.NewEvent.Properties;
                var processId   = Convert.ToUInt32(properties["ProcessID"].Value);
                var commandLine = GetProcessCommandLine(processId);

                var processName = Convert.ToString(properties["ProcessName"].Value);
                var processInfo = new ProcessInfo
                {
                    ProcessId   = processId,
                    ProcessName = processName !,
                    CommandLine = PreciseValue.Imprecise(commandLine)
                };
                handler(processInfo);
            };

            watcher.Start();
            return(watcher);
        }
    }
Beispiel #3
0
        public static IDisposable StartNew(Action <ProcessInfo> handler)
        {
            var watcher = new ManagementEventWatcher(
                new WqlEventQuery(@"select * from __InstanceCreationEvent within 1 where TargetInstance isa 'Win32_Process'"));

            watcher.EventArrived += (_, e) =>
            {
                var process     = (ManagementBaseObject)e.NewEvent["TargetInstance"];
                var processId   = Convert.ToUInt32(process.Properties["ProcessID"].Value);
                var processName = Convert.ToString(process.Properties["Name"].Value);
                var commandLine = Convert.ToString(process.Properties["CommandLine"].Value);
                var processInfo = new ProcessInfo
                {
                    ProcessId   = processId,
                    ProcessName = processName !,
                    CommandLine = PreciseValue.Precise(commandLine)
                };
                handler(processInfo);
            };

            watcher.Start();
            return(watcher);
        }
    }