How to find what executable the user has just started?

Question

I'm working on a testing framework that needs to be able to record a user's activities and then replay them. I'm fine using the ManagedWinAPI wrappers around P/Invoke ( working in C# ) to record mouse and keyboard activity, which works but I think that in order to make the recording more useful I need to know more about what happens when the user starts an application.

What I don't know is how to find that an application has just been started and what application it was. So supposing the user started my recording application then went over to the start menu and clicked on "Paint" I would like to be able to record "Paint.exe" starting up as an event ( or if they clicked a shortcut that passed some parameters it would be the value of that shortcut including the parameters ) because if I want to play back the recording on a different machine menu items may be in different places so the mouse activity could be deceptive.

What route do I need to be following to acquire this data? I haven't been able to find the terminology so I've not even really got the right things to put into a search engine...

Answer 1

The Tool Help Library can take a snapshot of the current processes. This can later be compared to another snapshot. But, just as No Refunds No Returns commented, this method cannot determine if it was a user action that started the process.

Answer 2

The proper way to do this is to write a driver and use process manager callbacks to get a notification each time a process is created. If you don't want to do that, you can use a managed hooking library like EasyHook and hook NtCreateThread/NtCreateThreadEx. If you don't want to do that, then you'll just have to poll for new processes.

EDIT: Determining whether the user started a particular process would also require you to walk the stack. In kernel-mode you can use RtlWalkFrameChain while in user-mode you can use CaptureStackBackTrace.

EDIT 2: See PsSetCreateProcessNotifyRoutine and PsSetCreateProcessNotifyRoutineEx.