How to monitor process creation?

**Elysia** · 03-15-2008

I dunno. It compiles for me (using 2008).
The only thing I can think of is that VC's headers are outdated.
Try right-clicking on COINIT_MULTITHREADED and select "go to declaration". See if it finds it.

You can also try a rebuild.
Make sure you did as the tutorial mentioned. Copying the first past into the first .cpp source file, the second into a header and the third into 2nd sound file and compile works for me.

**markiz** · 03-15-2008

If it compiles to you maybe you send this code to me?
By email or upload it to some web-storage.

**Elysia** · 03-15-2008

Copy n' paste, mate, copy n' paste.
All I was copy & paste.

**markiz** · 03-15-2008

Originally Posted by Elysia

Copy n' paste, mate, copy n' paste.
All I was copy & paste.

Me too.

**markiz** · 03-15-2008

What kind of project did you create?

**Elysia** · 03-15-2008

I simply used an existing console project.
But anyway, try finding the define, as I told you earlier. See if you can find them. Dig inside the headers.

**markiz** · 03-15-2008

Ok, the COINIT_MULTITHREADED error was fixed by adding #define _WIN32_DCOM to stdafx.h, why it's needed there?

**Elysia** · 03-15-2008

It needs to be defined before you include all the headers.

**markiz** · 03-15-2008

#define _WIN32_DCOM- what it for? Why do i need to include it?

**Elysia** · 03-15-2008

I don't know what it's used for, only that it seems you must define it to use COM (that or use a higher _WIN32_WINNT).

**markiz** · 03-15-2008

Ok, now the event us triggered when new process is created.
How Do I get the file name and path of this process?

**BobS0327** · 03-17-2008

How Do I get the file name and path of this process?

Once you have the process ID, you can use the code example at this link to get the complete command line of the process.

**Codeplug** · 03-17-2008

There's lots of information in the Win32_Process object in the callback to Indicate(). Replace your EventSink::Indicate() with this. It shows how to get a "pointer" to the Win32_Process object and then get its "ExecutablePath" property.

Code:

#include <comutil.h>
_COM_SMARTPTR_TYPEDEF(IWbemClassObject, __uuidof(IWbemClassObject));

HRESULT EventSink::Indicate(long lObjectCount, IWbemClassObject **apObjArray)
{
	HRESULT hres = S_OK;

    for (int i = 0; i < lObjectCount; i++)
    {
        cout << "Event occurred" << endl;
        IWbemClassObject *pObj = apObjArray[i];

        HRESULT hres;
        VARIANT vInst_;
        hres = pObj->Get(L"TargetInstance", 0, &vInst_, 0, 0);
        if (FAILED(hres))
        {
            cout << "Failed to get TargetInstance: " << hres << endl;
            continue;
        }//if

        try
        {
            _variant_t vInst;
            vInst.Attach(vInst_); // use C++ class to manage VARIANT

            IWbemClassObjectPtr pWin32ProcessObj(vInst);

            VARIANT vVar;
            hres = pWin32ProcessObj->Get(L"ExecutablePath", 0, &vVar, 0, 0);
            if (FAILED(hres))
            {
                cout << "Failed to get ExecutablePath: " << hres << endl;
            }//if
            else
            {
                _variant_t vExecPath;
                vExecPath.Attach(vVar);

                wcout << L"ExecPath: " << (const wchar_t*)((_bstr_t)vExecPath) << endl;
            }//else
        }//try
        catch(_com_error &err)
        {
            cout << "caught _com_error: " << err.Error() << endl;
        }//catch
    }//for

    return WBEM_S_NO_ERROR;
}//Indicate

gg

**abachler** · 03-17-2008

Originally Posted by Elysia

Yes, I see it's a fat example now, but Microsoft didn't include the right headers in the code. Bah. Stupid Microsoft.
What other errors? HRESULT you can get from Windows.h and COM stuff from objbase.h.

no the problem is he has teh project set as 'use precompiled headers' turn that option off and it shoudl compile fine

**Elysia** · 03-17-2008

It seems the inital understanding was wrong, but it's not the fault of precompiled headers.
The OP fixed that before.
It was an astray define, it seems.