I want to know whenever any application starts. Is there a windows message that I can set a hook for to know exactly when that happens?
views:
53answers:
2
+1
A:
The first message sent to new windows is WM_NCCREATE. But this has nothing to do with the process itself, which is what I suspect you're asking? By definition 'window messages' will start to arrive only after you create a window (using CreateWindowEx or whatever), but that can happen long after the process has started.
You don't say what language/framework you're using. In VC++ and the like you can just use whatever passes for the WinMain function. For VB it would be a Main function in a module.
kprobst
2010-01-21 23:58:32
Thank you for yoru response. If I used WM_NCCREATE, would I be able to know which process was started? It sounds like I wouldn't, from your comment. I'll be using C++ for the hook. What difference would that make?
Mike Pateras
2010-01-22 01:04:26
+2
A:
If polling is not a problem you could use one of the approaches described in the answers to a related question:
The suggested solutions use WMI or Windows audit process tracking mechanism.
0xA3
2010-01-22 00:15:12
Wow, I think that can work really well for what I am trying to do. Great suggestion!
Mike Pateras
2010-01-22 01:01:58