Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- using System;
- using System.Management;
- namespace HackForums.Example
- {
- class Program
- {
- static void Main()
- {
- ProcessInfo taskmgr = new ProcessInfo("Taskmgr.exe");
- taskmgr.Started += TaskmgrStarted;
- taskmgr.Terminated += TaskmgrTerminated;
- while (true){}
- }
- private static void TaskmgrStarted(object sender, EventArgs e)
- {
- Console.WriteLine("Task Manager is now open");
- }
- private static void TaskmgrTerminated(object sender, EventArgs e)
- {
- Console.WriteLine("Task Manager is now closed");
- }
- }
- public class ProcessInfo
- {
- public delegate void StartedEventHandler(object sender, EventArgs e);
- public delegate void TerminatedEventHandler(object sender, EventArgs e);
- public StartedEventHandler Started;
- public TerminatedEventHandler Terminated;
- public ProcessInfo(string appName)
- {
- string pol = "2";
- string scope = @"\\.\root\CIMV2";
- string queryString =
- $"SELECT * FROM __InstanceOperationEvent WITHIN {pol} WHERE TargetInstance ISA \'Win32_Process\' AND TargetInstance.Name = '{appName}'";
- ManagementEventWatcher watcher = new ManagementEventWatcher(scope, queryString);
- watcher.EventArrived += OnEventArrived;
- watcher.Start();
- }
- private void OnEventArrived(object sender, EventArrivedEventArgs e)
- {
- try
- {
- string eventName = e.NewEvent.ClassPath.ClassName;
- if (string.Compare(eventName, "__InstanceCreationEvent", StringComparison.Ordinal) == 0)
- {
- Started?.Invoke(this, e);
- }
- else if (string.Compare(eventName, "__InstanceDeletionEvent", StringComparison.Ordinal) == 0)
- {
- Terminated?.Invoke(this, e);
- }
- }
- catch (Exception ex)
- {
- System.Diagnostics.Debug.WriteLine(ex.Message);
- }
- }
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment