Foro de elhacker.net

Bueno decidí compartir este código lo acabo de hacer sirve para capturar los procesos que se han iniciado y los que se han terminado, me parece bastante útil, utiliza como base WMI solo que en la clase está mucho más administrado y más cómodo de utilizar. Deben liberar el objeto con .Dispose cuando vayan a cerrar la aplicación que use la clase o lanza un error.

Public Class ProcessWatcher
 
    Partial Class StoppedProcess
 
        Public Sub New(ByVal PropertiesDictionary As Dictionary(Of String, Object))
 
            Dim AllFlags As BindingFlags = &H107FF7F
            Dim Field As FieldInfo = Nothing
 
            For Each FieldProperty As KeyValuePair(Of String, Object) In PropertiesDictionary
                Field = Me.GetType.GetField("_" & FieldProperty.Key, AllFlags)
                If Field IsNot Nothing Then
                    Field.SetValue(Me, FieldProperty.Value)
                End If
            Next
 
        End Sub
 
#Region " Properties "
 
        Private _ProcessName As String
        Public ReadOnly Property ProcessName() As String
            Get
                Return _ProcessName
            End Get
        End Property
 
        Private _ProcessID As UInteger
        Public ReadOnly Property Id() As UInteger
            Get
                Return _ProcessID
            End Get
        End Property
 
        Private _ParentProcessID As UInteger
        Public ReadOnly Property ParentProcessId() As UInteger
            Get
                Return _ParentProcessID
            End Get
        End Property
 
        Private _ExitStatus As UInteger
        Public ReadOnly Property ExitCode() As UInteger
            Get
                Return _ExitStatus
                Process.GetCurrentProcess()
            End Get
        End Property
 
        Private _SessionID As UInteger
        Public ReadOnly Property SessionId() As UInteger
            Get
                Return _SessionID
            End Get
        End Property
 
#End Region
 
    End Class
 
    Public Event Started(ByVal e As Process)
    Public Event Stopped(ByVal e As StoppedProcess)
 
    Private ProcessQueryEvent_Start As WqlEventQuery
    Private ProcessWatcher_Start As ManagementEventWatcher
 
    Private ProcessQueryEvent_Stop As WqlEventQuery
    Private ProcessWatcher_Stop As ManagementEventWatcher
 
    Private WatcherEnabled As Boolean = False
 
    Public Sub New(Optional ByVal AutoStart As Boolean = True, _
                   Optional ByVal SetAsFalseCheckForIllegalCrossThreadCalls As Boolean = False, _
                   Optional ByVal Frequency As Double = 1000)
 
        ProcessQueryEvent_Start = New WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace")
        ProcessWatcher_Start = New ManagementEventWatcher(ProcessQueryEvent_Start)
 
        ProcessQueryEvent_Stop = New WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace")
        ProcessWatcher_Stop = New ManagementEventWatcher(ProcessQueryEvent_Stop)
 
        AddHandler ProcessWatcher_Start.EventArrived, AddressOf StartEvent
        AddHandler ProcessWatcher_Stop.EventArrived, AddressOf StopEvent
 
        ProcessQueryEvent_Start.WithinInterval = TimeSpan.FromMilliseconds(Frequency)
        ProcessQueryEvent_Stop.WithinInterval = TimeSpan.FromMilliseconds(Frequency)
 
        Control.CheckForIllegalCrossThreadCalls = Not SetAsFalseCheckForIllegalCrossThreadCalls
 
        If AutoStart Then
            Enabled = True
        End If
 
    End Sub
 
    Private Sub StopEvent(ByVal sender As Object, ByVal e As EventArrivedEventArgs)
 
        Dim RawDictionary As New Dictionary(Of String, Object)
 
        For Each ProcessProperty As PropertyData In e.NewEvent.Properties
            If Not ProcessProperty.IsArray Then
                RawDictionary.Add(ProcessProperty.Name, e.NewEvent(ProcessProperty.Name))
            End If
        Next
 
        RaiseEvent Stopped(New StoppedProcess(RawDictionary))
 
    End Sub
 
    Private Sub StartEvent(ByVal sender As Object, ByVal e As EventArrivedEventArgs)
        RaiseEvent Started(Process.GetProcessById(e.NewEvent("ProcessID")))
    End Sub
 
    Public Property Frequency() As Double
        Get
            Return ProcessQueryEvent_Start.WithinInterval.TotalMilliseconds
        End Get
        Set(ByVal value As Double)
            If value < 0 Then
                Throw New ArgumentException("value")
            Else
                ProcessQueryEvent_Start.WithinInterval = TimeSpan.FromMilliseconds(value)
                ProcessQueryEvent_Stop.WithinInterval = TimeSpan.FromMilliseconds(value)
            End If
        End Set
    End Property
 
    Public Property Enabled() As Boolean
        Get
            Return WatcherEnabled
        End Get
        Set(ByVal value As Boolean)
            If WatcherEnabled Then
                ProcessWatcher_Start.Stop()
                ProcessWatcher_Stop.Stop()
            Else
                ProcessWatcher_Start.Start()
                ProcessWatcher_Stop.Start()
            End If
            WatcherEnabled = Not WatcherEnabled
        End Set
    End Property
 
    Public Sub Dispose()
 
        If Enabled Then
            ProcessWatcher_Start.Stop()
            ProcessWatcher_Stop.Stop()
        End If
 
        ProcessWatcher_Start.Dispose()
        ProcessWatcher_Stop.Dispose()
 
    End Sub
 
End Class
 

Un poco largo el código :-X

Los parametros del constructor son:

AutoStart, Boolean, True para iniciar automáticamente con la construcción y False para iniciar después mediante la propiedad Enabled.

SetAsFalseCheckForIllegalCrossThreadCalls, Boolean, True para desactivar la detección de llamadas de controles fuera del MainThread y false para activar.

Frequency, Double, el intervalo en milisegundos en cuál se va a chequear.