Below is a small quick driver that uses PsSetCreateProcessNotifyRoutine.
Display the debug prints with DebugView, windbg, etc.
Note: I haven't compiled this sample, please fix it as needed.
Of course, you need the current WDK and SOURCES file to build it.
Function PsGetProcessImageFileName() is undocumented and deprecated for
"serious" use,
but again, may work for your goal.
Regards,
--PA
----------------- cut here ---------------------
#include <ntddk.h>
VOID DriverUnload(IN PDRIVER_OBJECT DriverObject);
VOID CreateProcCallback(HANDLE ParentId, HANDLE ProcessId, BOOLEAN
Create)
{
NTSTATUS status;
PCHAR procImageName = NULL;
if ( Create )
{
PEPROCESS peProcess = NULL;
status = PsLookupProcessByProcessId(ProcessId, &peProcess);
if (!NT_SUCCESS(status)) {
KdPrint(("Err PsLookupProcessByProcessId\n"));
return;
}
procImageName = PsGetProcessImageFileName(peProcess); //*** DEPRECATED
if (!procImageName) {
KdPrint(("err PsGetProcessImageFileName!\n"));
}
ObDereferenceObject(peProcess);
KdPrint(("START process name=[%s] pid=%d parent=%d\n", procImageName,
ProcessId, ParentId ));
} else {
KdPrint(("EXIT process pid=%d\n", ProcessId ));
}
}
NTSTATUS DriverEntry ( PDRIVER_OBJECT DriverObject, PUNICODE_STRING
RegistryPath)
{
NTSTATUS status;
status = PsSetCreateProcessNotifyRoutine(CreateProcCallback, FALSE);
if (!NT_SUCCESS(status)) return status;
DriverObject->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}
VOID DriverUnload(PDRIVER_OBJECT DriverObject)
{
NTSTATUS status;
status = PsSetCreateProcessNotifyRoutine(CreateProcCallback, TRUE);
}
----------------- cut here ---------------------
Strange, my latest WDK documentation has no info about
PsGetProcessImageFileName ... To OP: Another, alternative solution is to set
image load notify routine (using PsSetLoadImageNotifyRoutine) and log all
UNICODE_STRINGs which are passed into your callback.
--
Volodymyr, blog: http://www.shcherbyna.com/
(This posting is provided "AS IS" with no warranties, and confers no
rights)
"Pavel A." <pav...@12fastmail34.fm> wrote in message
news:%23QX9BWr...@TK2MSFTNGP04.phx.gbl...