C / C++ / MFC

Catching the launch of an applicatin

2-Nov-07 1:47

The last Long equivalent Date type I heard of was in VB6, these days you'll probably need to do your own conversion or put up with storing at least 8 bytes. Have a look at the GetSystemTime and SystemTimeToFileTime API calls and their associated structures. A conversion to something like

<br />
struct LongDate<br />
{<br />
  WORD Year;//AD year - 1600<br />
  WORD DayNumber;//1-365<br />
};<br />

would be pretty trivial and you could shoe-horn that into a long.

Nothing is exactly what it seems but everything with seems can be unpicked.

Re: About Date

David Crow2-Nov-07 3:01

David Crow

2-Nov-07 3:01

Manish_mnp wrote:
how to get Current System Date in Long?

Use the time() function.

jpgossieaux01-Nov-07 23:57

jpgossieaux0

1-Nov-07 23:57

Hi,

How can I know, that an application has been launched ?

Is there a windows event or something like that ?

Thank you for helping me.

Jphil

Matthew Faithfull2-Nov-07 0:25

2-Nov-07 0:25

You can only know reliably if the launched application chooses to tell you. The best and most common way to do this, for example to prevent more than one copy of an app running, is to use a named Kernel object like a Mutex or Semaphore which can be accessed by name from more than one process and locked to prevent multiple usage. A shared named Kernel Event Object could be used if you simply want to watch for an app launch. If it's a 3rd party, black box app that you can't change then you'll either need to use some form of Dll injection to add the Event code to it or fall back to older unreliable methods like enumerating top level windows to look for an application specific name.

Nothing is exactly what it seems but everything with seems can be unpicked.

jpgossieaux02-Nov-07 0:39

jpgossieaux0

2-Nov-07 0:39

Matthew,

Thank you for you reply.
It gives me some clues.

In fact I want to control the launching of application developed by third parties.
You tell about DLL injection ? could you tell me more about that ?

Up to kow, I used a method based on the function "CreateToolHelp32Snapshot" to get a view of all running process. Of course I need to take a snapshot very often (in a loop). Hopefully, it seems no to take to much resources.

Once I see the launching of a new application I could kill it, if not authorized.
But the window of the application is displayed for a short time, which is no very beautifull !!

I'm sure that hackers can catch application launching.

Thank you for your help

Jean-Philippe

Matthew Faithfull2-Nov-07 0:57

2-Nov-07 0:57

The principle of Dll injection is that you get the 3rd party app to load your dll into itself which gives you an opportunity to run some code, override window classes, install some hooks or whatever into an exisiting application. I'm no expert on this but there are articles on CP about it.
In this case your injected Dll would need to establish the command line of the executable that had loaded it, this info is accessible as part of the PROCESS_INFO structure which it should be able to retrieve. If this is an app you want to block then it would Set a named shared Kernel Event that your other process is already waiting on. It might also need some way of communicating the Process ID of the 'bad' process to the monitor, or you could kep the ToolHelp sapshot based scan and just trigger it on the event, or just get the Dll to kill the process itself, Dead | X|

This may indeed be able to shut down the disallowed process before the user sees anything but it really is no substitute to preventing them launching it in the first place using the Windows user account permissions system.

Nothing is exactly what it seems but everything with seems can be unpicked.

David Crow2-Nov-07 3:06

David Crow

2-Nov-07 3:06

Have you tried looking for the WM_CREATE message via SetWindowsHookEx(WH_CALLWNDPROC, ...)?

TClarke2-Nov-07 4:00

TClarke

2-Nov-07 4:00

Using a global hook similar to the one above is what I used great success

Cheers
Tom

Philosophy: The art of never getting beyond the concept of life.

Religion: Morality taking credit for the work of luck.

"The object of life is not to be on the side of the majority, but to escape finding oneself in the ranks of the insane."
- Marcus Aurelius

jpgossieaux05-Nov-07 6:46

jpgossieaux0

5-Nov-07 6:46

I try a hook function CallWndProc to catch the WM_CREATE event.
The problem is that a lot of windows are created when a program is launched.
It is not easy to determine the first one. Moreover, the first one is not always the main window of the launched application.
Also the name of the executable is not returned by the Hook function.

Maybe is there another message ? I dind't see it !!

Garth J Lancaster2-Nov-07 13:08

Garth J Lancaster

2-Nov-07 13:08

is this http://www.codeproject.com/threads/procmon.asp[^] any use

'g'

pointer on reference ?

Rage1-Nov-07 23:55

Rage

1-Nov-07 23:55

What is this supposed to mean :

bool CMyClass::MyFuntion( LPCTSTR pStr, const XStr *&pSourceStr )

Is this legal ? What is the idea behind ?

~RaGE();

I think words like 'destiny' are a way of trying to find order where none exists. - Christian Graus

Do not feed the troll ! - Common proverb

manish.patel2-Nov-07 0:02

manish.patel

2-Nov-07 0:02

Yes, it is valid if it is given in Correct manour

&pSourceStr -> it gives address of the pSourceStr

And
*&pSourceStr -> it gives Data on that address.

Matthew Faithfull2-Nov-07 0:19

2-Nov-07 0:19

Yes it is legal, this is how it breaks down, assuming the function was static just for example's sake

LPCTSTR pStr = _T("SomeString");
const XStr Source = _T("SomeSuperString");
const XStr* pSourceStr = &Source;
bool bResult = CMyClass::MyFunction( pStr, pSourceStr );
//pSourceStr may have been modified by the call but Source will still be the same

The function takes a pointer-by-reference, that is a reference to a pointer, as its second parameter. What this means to the caller is that when the function returns pSourceStr might have changed, it might point somewhere else now, but Source will not have.
This is usually done to get, in effect, a second return value from the function. The function will modify pSourceStr in order to communicate it back to the caller along with the bool result.

Nothing is exactly what it seems but everything with seems can be unpicked.

Rage2-Nov-07 3:12

Rage

2-Nov-07 3:12

Cristal clear, thanks Matthew !

~RaGE();

I think words like 'destiny' are a way of trying to find order where none exists. - Christian Graus

Do not feed the troll ! - Common proverb