How to hook into application and process startup in windows?

by

You didn’t mention your prefered programming language, so I’ll use C# for example snippets.

You can start a process and capture/write into its standard IO streams.

The following snippet, opens a process and captures its StdOut stream:

using (var process = Process.Start(new ProcessStartInfo(FileName = @"yourExecutablePath", UseShellExecute = false, RedirectStandardOutput = true)))
    using (var stdout = process.StandardOutput)
        Console.WriteLine(stdout.ReadToEnd());

EDIT 1

Looks like you want to hook Windows APIs like CreateProcess.

One way to do so is to write a kernel driver and use hooking techniques such as SSTD patching. But writing a kernel driver IMO is cumbersome.

In some cases you can use user-level hooks. There are a few libraries that might help you with that, including: EasyHook, Deviare, and MS Detour.

EDIT 2

You can also use WMI as @David Heffernan suggested but it will only notify you AFTER the process gets started (as opposed to hooking, which allows you to run some arbitrary code BEFORE the hooked function gets called and/or override the function call):

using System.Management;

// Run this in another thread and make sure the event watcher gets disposed before exit

var start = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));    

start.EventArrived += new EventArrivedEventHandler(delegate (object sender, EventArrivedEventArgs e) {
    console.WriteLine("Name: {0}, Command Line: {1}", e.NewEvent.Properties["ProcessName"].Value, e.NewEvent.Properties["Commandline"].Value);
});

start.Start()

More Related Contents:

  1. How to have multiple colors in a Windows batch file?
  2. How can I echo a newline in a batch file?
  3. A Windows equivalent of the Unix tail command [closed]
  4. Is there a command to refresh environment variables from the command prompt in Windows?
  5. What is a Windows Handle?
  6. Which icon sizes should my Windows application’s icon include?
  7. How to verify if a file exists in a batch file?
  8. Hide console of Windows Application
  9. Stop and Start a service via batch or cmd file?
  10. Batch file variables initialized in a for loop
  11. What does symbol ^ mean in Batch script?
  12. Compiling assembly in Visual Studio
  13. Prerequisites for learning MFC programming [closed]
  14. How to run an awk commands in Windows?
  15. Run Windows 10 Universal Apps on Windows 8.1
  16. What is the smallest possible Windows (PE) executable?
  17. env: bash\r: No such file or directory [duplicate]
  18. Launch an external application from node.js
  19. ^M at the end of every line in vim
  20. Delete files or folder recursively on Windows CMD
  21. How do I install just the client tools for PostgreSQL on Windows?
  22. Determine Intel HD Graphics Card Version Via WinAPI
  23. Set window position of an application on Windows command line
  24. How do I mount a Docker volume while using a Windows host?
  25. Where does Microsoft Windows’ 7 POSIX implementation currently stand?
  26. How to change Screen buffer size in Windows Command Prompt from batch script
  27. Delete all files and folders in a directory
  28. Check if a Win32 thread is running or in a suspended state
  29. Windows Script Host Error: Invalid character – Code:800A03F6 – Source: Microsoft JScript compilation error
  30. Accessing a single file with multiple threads

Leave a Comment